Who makes the final determination regarding the distribution of the audit report?

The audit is performed on behalf of the client, who commissions the audit. Therefore, the audit report is the property of the client. While the lead auditor is responsible for preparing and issuing the report, the client retains the ultimate authority and makes the final determination regarding its distribution. The distribution list is typically agreed upon during the audit planning phase and is documented in the audit plan, which is approved by the client. The auditor's responsibility is to ensure the report is distributed according to the client's instructions while maintaining confidentiality.

A. The lead auditor: The lead auditor manages the audit and prepares the report, but they act on behalf of the client and do not have the final authority over report distribution.
B. The audit group manager: The audit group manager oversees the audit program but does not own the output of a specific audit; ownership rests with the client who requested it.
C. The auditee: The auditee is the subject of the audit and a primary recipient of the report, but they do not have the authority to control its distribution to other parties.

1. ISO 19011:2018, Guidelines for auditing management systems. Clause 6.6.2, "Distributing the audit report," states: "The approved audit report should then be distributed to the relevant interested parties, as defined in the audit plan or audit programme procedures." The audit plan and programme are established under the authority of the individual(s) managing the audit programme, on behalf of the client.

2. Russell, J. P. (Ed.). (2021). The ASQ Certified Quality Auditor Handbook (5th ed.). ASQ Quality Press. In Chapter 11, "Audit Reporting," the section on "Report Distribution" explicitly states, "The audit report is the property of the client. The client determines who should receive copies of the report." (p. 188).

3. Sayle, A. J. (1997). Management Audits: The Assessment of Quality Management Systems (3rd ed.). Allan J Sayle. In Chapter 11, "The Report," it is noted that "The report is the property of the client and should not be shown to any third party without the client's express permission." (p. 311). This reinforces the principle of client ownership and control over distribution.